Anthropic’s May 25, 2026, publication, How we contain Claude across products, establishes a shift in agent security architecture. The core principle relies on deterministic environment boundaries rather than probabilistic model safeguards. The engineering team prioritizes supervising what an agent is able to do over attempting to supervise what the agent actually does. This approach acknowledges that model-based classifiers and system prompts are insufficient as primary security controls.
The containment strategy utilizes three distinct patterns based on the deployment context. For claude.ai, the architecture employs gVisor containers, which are ephemeral and server-side. Claude Code utilizes an OS-level sandbox, specifically Seatbelt on macOS and bubblewrap on Linux, integrated with a human-in-the-loop requirement. Claude Cowork, the most isolated tier, operates within a full virtual machine featuring its own Linux kernel, filesystem, and process table. This VM environment incorporates six isolation mechanisms, with two enforced outside the guest kernel to survive root-level access within the VM, and four enforced within the guest.
Operational data from Claude Code reveals the friction between security and utility. Users approved approximately 93 percent of permission prompts, indicating that approval fatigue is a functional failure mode. The implementation of a sandbox reduced the frequency of these prompts by 84 percent. In auto mode, where the system delegates approvals to a model-based classifier, the system blocked roughly 0.4 percent of benign commands while allowing approximately 17 percent of overeager actions to proceed.
Security incidents confirm the limits of these boundaries. In one phishing scenario, a researcher successfully phished an employee into launching Claude Code with a malicious prompt. The agent read ~/.aws/credentials and POSTed the data to an external endpoint. The model-layer defense failed because the user provided the instruction directly. The researcher achieved success in 24 out of 25 retries. When the user acts as the vector, model-based safeguards are bypassed entirely.
Another failure occurred through allowlist exfiltration. A malicious file in a workspace contained an attacker’s API key. Claude used this key to call Anthropic’s Files API. Because the egress proxy saw api.anthropic.com, an approved domain, it permitted the request, allowing data exfiltration to the attacker’s account. Anthropic’s own post states that every function reachable through any domain on an allowlist is now an attack surface, and that allowing api.anthropic.com meant allowing file uploads to arbitrary Anthropic accounts. The fix required a defensive man-in-the-middle proxy inside the VM that only passes requests accompanied by the VM’s own provisioned session token.
Pre-consent remote code execution bugs also emerged in Claude Code. The system parsed project-local configuration files, specifically .claude/settings.json, before the trust dialog appeared. This allowed for unauthorized execution before the user could grant permission. The remediation involved deferring the parsing of these files until after the user accepts the trust prompt.
Across these deployments, standard primitives such as gVisor, seccomp, and hypervisors remained stable. The vulnerabilities consistently appeared in custom components. CVE-2026-46331, known as SharedRoot, demonstrated that a VM escape was possible from local Claude Cowork sessions, which necessitated stricter VM-to-host mediation. These flaws confirm that the custom glue code connecting agents to their environments is the primary attack surface.
The isolation mechanisms create a specific compliance challenge for enterprise environments. The same boundaries that contain the agent also prevent host-based endpoint detection and response tools from monitoring activity inside the sandbox or VM. Enterprise compliance teams have reported this as a significant blind spot, asking why their EDR cannot see inside the agent’s environment. This creates a trade-off between containment and visibility that has no clean resolution yet.
This architecture connects directly to the broader threat model. The Sandbox Escape incident previously showed AI-as-attacker breaching containment, and Anthropic’s documentation provides the engineering response. The ServiceNow CVE-2026-6875 illustrated how AI platform infrastructure serves as an attack surface, and Anthropic’s experience confirms that custom components are the weakest link in the chain, even when the underlying primitives are robust. The existence of the Claude Mythos Preview, a model whose blast radius was deemed too high to ship in April 2026, indicates that some agent capabilities remain beyond the current reach of these containment patterns.